@contractkit/plugin-typescript 0.28.0 → 0.28.1

package/dist/path-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-utils.d.ts","sourceRoot":"","sources":["../src/path-utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGtE,eAAO,MAAM,eAAe,QAAY,CAAC;AAEzC,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAEtF;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAGnD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAclE;AAID,wBAAgB,gBAAgB,CAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAClC,MAAM,CAiBR;AAED,wBAAgB,sBAAsB,CAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAClC,MAAM,CAER;AAID,wBAAgB,iBAAiB,CAC7B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAClC,MAAM,GAAG,IAAI,CAkBf;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAoBnH;AAED,wBAAgB,qBAAqB,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAClC,MAAM,GAAG,IAAI,CAef;AAED,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,CAiBnG;AAED,wBAAgB,6BAA6B,CACzC,MAAM,EAAE,UAAU,EAAE,EACpB,YAAY,EAAE,gBAAgB,EAAE,EAChC,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,EAC5B,gBAAgB,GAAE,GAAG,CAAC,MAAM,CAAa,GAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CA0CpB"}
+{"version":3,"file":"path-utils.d.ts","sourceRoot":"","sources":["../src/path-utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGtE,eAAO,MAAM,eAAe,QAAY,CAAC;AAmBzC,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAEtF;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAGnD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAclE;AAID,wBAAgB,gBAAgB,CAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAClC,MAAM,CAiBR;AAED,wBAAgB,sBAAsB,CAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAClC,MAAM,CAER;AAID,wBAAgB,iBAAiB,CAC7B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAClC,MAAM,GAAG,IAAI,CAkBf;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAoBnH;AAED,wBAAgB,qBAAqB,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAClC,MAAM,GAAG,IAAI,CAef;AAED,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,CAiBnG;AAED,wBAAgB,6BAA6B,CACzC,MAAM,EAAE,UAAU,EAAE,EACpB,YAAY,EAAE,gBAAgB,EAAE,EAChC,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,EAC5B,gBAAgB,GAAE,GAAG,CAAC,MAAM,CAAa,GAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CA0CpB"}

package/dist/ts-render.d.ts

@@ -1,6 +1,12 @@
 import type { ContractTypeNode } from '@contractkit/core';
 export declare const JSON_VALUE_TYPE_DECL = "export type JsonValue = string | number | boolean | null | JsonValue[] | { [key: string]: JsonValue };";
 export declare function quoteKey(name: string): string;
+/** Escape text for safe inclusion inside a JSDoc block comment: neutralize the
+ *  block-comment terminator sequence and split embedded newlines into separate
+ *  ` * ` continuation lines. Returns the content lines (WITHOUT a leading prefix). */
+export declare function escapeJsDocLines(text: string): string[];
+/** Escape a string for inclusion inside a single-quoted TypeScript string literal. */
+export declare function escapeSingleQuoted(s: string): string;
 /** Convert an HTTP header name (e.g. `preference-applied`, `X-Request-ID`, `ETag`) to camelCase for use as a JS property. */
 export declare function headerNameToProperty(name: string): string;
 export declare function renderTsType(type: ContractTypeNode): string;

package/dist/ts-render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ts-render.d.ts","sourceRoot":"","sources":["../src/ts-render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAa,MAAM,mBAAmB,CAAC;AAErE,eAAO,MAAM,oBAAoB,2GAA2G,CAAC;AAE7I,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,6HAA6H;AAC7H,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQzD;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAoC3D;AA4CD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,EAAE,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CA2B/F;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CA2BjG"}
+{"version":3,"file":"ts-render.d.ts","sourceRoot":"","sources":["../src/ts-render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAA6B,MAAM,mBAAmB,CAAC;AAErF,eAAO,MAAM,oBAAoB,2GAA2G,CAAC;AAE7I,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED;;sFAEsF;AACtF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvD;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,6HAA6H;AAC7H,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQzD;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAoC3D;AA+CD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,EAAE,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CA2B/F;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CA2BjG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contractkit/plugin-typescript",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "ContractKit built-in plugin: TypeScript codegen (SDK clients, Koa routers, Zod schemas, plain types)",
   "author": {
     "name": "Marooned Software",
@@ -26,7 +26,7 @@
     ".": "./dist/index.js"
   },
   "dependencies": {
-    "@contractkit/core": "0.22.0"
+    "@contractkit/core": "0.23.0"
   },
   "devDependencies": {
     "@repo/config-eslint": "0.3.1",

package/src/codegen-contract.ts

@@ -21,6 +21,7 @@ import {
     computeModelsWithOutput as ckComputeModelsWithOutput,
     collectExternalOutputRefs as ckCollectExternalOutputRefs,
 } from '@contractkit/core';
+import { escapeJsDocLines } from './ts-render.js';
 
 /**
  * Maps a ContractKit object mode to its Zod constructor name.
@@ -108,7 +109,7 @@ function generateComments(model: ModelNode, outPath?: string): string[] {
         lines.push(` * @deprecated`);
     }
     if (model.description) {
-        lines.push(` * ${model.description}`);
+        for (const l of escapeJsDocLines(model.description)) lines.push(` * ${l}`);
     }
 
     const relPath = outPath ? relative(dirname(outPath), model.loc.file) : model.loc.file;
@@ -664,8 +665,10 @@ function renderScalar(s: ScalarTypeNode): string {
             return '_ZodBinary';
         case 'json':
             return '_ZodJson';
-        default:
-            return 'z.unknown()';
+        default: {
+            const _exhaustive: never = s.name;
+            throw new Error(`plugin-typescript: unmapped scalar '${String(_exhaustive)}' — add a case`);
+        }
     }
 }
 
@@ -685,7 +688,7 @@ function renderRecord(r: RecordTypeNode): string {
 }
 
 function renderEnum(e: EnumTypeNode): string {
-    const vals = e.values.map(v => `"${v}"`).join(', ');
+    const vals = e.values.map(v => `"${escapeString(v)}"`).join(', ');
     return `z.enum([${vals}])`;
 }
 

package/src/codegen-operation.ts

@@ -9,7 +9,7 @@ import {
     typeNeedsScalar,
     modeToWrapper,
 } from './codegen-contract.js';
-import { renderOutputTsType, quoteKey, headerNameToProperty } from './ts-render.js';
+import { renderOutputTsType, quoteKey, headerNameToProperty, escapeJsDocLines, escapeSingleQuoted } from './ts-render.js';
 import { basename, dirname, relative } from 'path';
 
 // ─── Content-type helpers ──────────────────────────────────────────────────
@@ -217,7 +217,7 @@ function generateHandler(route: OpRouteNode, op: OpOperationNode, root: OpRootNo
     // JSDoc from description
     const desc = op.description ?? route.description;
     if (desc) {
-        lines.push(` * ${desc}`);
+        for (const l of escapeJsDocLines(desc)) lines.push(` * ${l}`);
     }
     // Source location comment
     const relFile = outPath ? relative(dirname(outPath), file) : file;
@@ -261,8 +261,8 @@ function generateHandler(route: OpRouteNode, op: OpOperationNode, root: OpRootNo
     }
     if (op.signature) {
         const sigArgs = op.signaturePolicy
-            ? `'${op.signature}', { policy: '${op.signaturePolicy}' }`
-            : `'${op.signature}'`;
+            ? `'${escapeSingleQuoted(op.signature)}', { policy: '${escapeSingleQuoted(op.signaturePolicy)}' }`
+            : `'${escapeSingleQuoted(op.signature)}'`;
         middlewares.push(`requireSignature(${sigArgs})`);
     }
     const middlewareStr = middlewares.length > 0 ? `, ${middlewares.join(', ')},` : ',';

package/src/codegen-plain-types.ts

@@ -10,7 +10,7 @@ import {
     resolveImportPath,
     rootNeedsScalar,
 } from './codegen-contract.js';
-import { renderTsType, renderInputTsType, renderOutputTsType, quoteKey, JSON_VALUE_TYPE_DECL } from './ts-render.js';
+import { renderTsType, renderInputTsType, renderOutputTsType, quoteKey, escapeJsDocLines, JSON_VALUE_TYPE_DECL } from './ts-render.js';
 
 // ─── Public entry point ────────────────────────────────────────────────────
 
@@ -123,7 +123,7 @@ function generateComments(model: ModelNode, outPath?: string): string[] {
         lines.push(` * @deprecated`);
     }
     if (model.description) {
-        lines.push(` * ${model.description}`);
+        for (const l of escapeJsDocLines(model.description)) lines.push(` * ${l}`);
     }
 
     const relPath = outPath ? relative(dirname(outPath), model.loc.file) : model.loc.file;
@@ -205,6 +205,18 @@ function generateVisibilityModel(model: ModelNode, outPath?: string, modelsWithI
 
 // ─── Field rendering ──────────────────────────────────────────────────────
 
+/** Prefix a field declaration with a JSDoc comment built from `@deprecated` / description parts,
+ *  neutralizing any block-comment terminator and expanding embedded newlines into continuation lines. */
+function withFieldJsDoc(jsdocParts: string[], line: string): string {
+    if (jsdocParts.length === 0) return line;
+    const contentLines = escapeJsDocLines(jsdocParts.join(' '));
+    if (contentLines.length === 1) {
+        return `/** ${contentLines[0]} */\n    ${line}`;
+    }
+    const body = contentLines.map(l => `     * ${l}`).join('\n');
+    return `/**\n${body}\n     */\n    ${line}`;
+}
+
 function renderField(field: FieldNode): string {
     const opt = field.optional || field.default !== undefined ? '?' : '';
     let typeStr = renderTsType(field.type);
@@ -213,10 +225,7 @@ function renderField(field: FieldNode): string {
     const jsdocParts: string[] = [];
     if (field.deprecated) jsdocParts.push('@deprecated');
     if (field.description) jsdocParts.push(field.description);
-    if (jsdocParts.length > 0) {
-        return `/** ${jsdocParts.join(' ')} */\n    ${line}`;
-    }
-    return line;
+    return withFieldJsDoc(jsdocParts, line);
 }
 
 function renderInputField(field: FieldNode, modelsWithInput: Set<string>): string {
@@ -227,10 +236,7 @@ function renderInputField(field: FieldNode, modelsWithInput: Set<string>): strin
     const jsdocParts: string[] = [];
     if (field.deprecated) jsdocParts.push('@deprecated');
     if (field.description) jsdocParts.push(field.description);
-    if (jsdocParts.length > 0) {
-        return `/** ${jsdocParts.join(' ')} */\n    ${line}`;
-    }
-    return line;
+    return withFieldJsDoc(jsdocParts, line);
 }
 
 // ─── Output (post-transform wire shape) ──────────────────────────────────
@@ -297,8 +303,5 @@ function renderOutputField(field: FieldNode, outputCase: 'camel' | 'snake' | 'pa
     const jsdocParts: string[] = [];
     if (field.deprecated) jsdocParts.push('@deprecated');
     if (field.description) jsdocParts.push(field.description);
-    if (jsdocParts.length > 0) {
-        return `/** ${jsdocParts.join(' ')} */\n    ${line}`;
-    }
-    return line;
+    return withFieldJsDoc(jsdocParts, line);
 }

package/src/codegen-sdk.ts

@@ -1,6 +1,6 @@
 import type { OpRootNode, OpRouteNode, OpOperationNode, OpRequestBodyNode, ContractTypeNode, ParamSource } from '@contractkit/core';
 import { resolveModifiers, isJsonMime, classifyContentType } from '@contractkit/core';
-import { renderInputTsType, renderOutputTsType, quoteKey, headerNameToProperty, JSON_VALUE_TYPE_DECL } from './ts-render.js';
+import { renderInputTsType, renderOutputTsType, quoteKey, headerNameToProperty, escapeJsDocLines, JSON_VALUE_TYPE_DECL } from './ts-render.js';
 import { pascalToDotCase, typeNeedsScalar } from './codegen-contract.js';
 import { bodyTypesStructurallyEqual } from './codegen-operation.js';
 import { basename, dirname, relative } from 'path';
@@ -289,11 +289,12 @@ function generateMethod(route: OpRouteNode, op: OpOperationNode, file: string, o
         const tags: string[] = [];
         if (op.name) tags.push(`@name ${op.name}`);
         if (desc) tags.push(`@description ${desc}`);
-        if (tags.length === 1) {
-            lines.push(`    /** ${tags[0]} */`);
+        const contentLines = tags.flatMap(t => escapeJsDocLines(t));
+        if (contentLines.length === 1) {
+            lines.push(`    /** ${contentLines[0]} */`);
         } else {
             lines.push(`    /**`);
-            for (const tag of tags) lines.push(`     * ${tag}`);
+            for (const l of contentLines) lines.push(`     * ${l}`);
             lines.push(`     */`);
         }
     }

package/src/path-utils.ts

@@ -1,9 +1,26 @@
-import { resolve, join, relative, dirname } from 'node:path';
+import { resolve, join, relative, dirname, isAbsolute } from 'node:path';
 import type { ContractRootNode, OpRootNode } from '@contractkit/core';
 import { collectTypeRefs, collectPublicTypeNames } from '@contractkit/core';
 
 export const TEMPLATE_VAR_RE = /\{\w+\}/;
 
+/**
+ * Guard against path traversal in output-path templates. Output-path template variables
+ * (`{area}`, `{dir}`, `{filename}`, `{name}`) can be sourced from a `.ck` file's
+ * `options { keys }` block, so a malicious value like `../../../tmp/x` could escape the
+ * plugin's output directory. After the final absolute path is computed, verify it stays
+ * within `baseOutDir`; otherwise throw.
+ */
+function assertWithinBase(baseOutDir: string, outPath: string): string {
+    const rel = relative(resolve(baseOutDir), resolve(outPath));
+    if (rel === '' || rel.startsWith('..') || isAbsolute(rel)) {
+        throw new Error(
+            `Refusing to emit outside output directory: resolved path "${outPath}" escapes "${baseOutDir}" (check options { keys } values used in output path templates)`,
+        );
+    }
+    return outPath;
+}
+
 export function resolveTemplate(template: string, vars: Record<string, string>): string {
     return template.replace(/\{(\w+)\}/g, (_, key) => vars[key] ?? `{${key}}`);
 }
@@ -47,14 +64,14 @@ export function computeOpOutPath(
 
     if (output && TEMPLATE_VAR_RE.test(output)) {
         const resolved = resolveTemplate(output, { filename, dir: relDir, ext: 'ck', ...meta });
-        if (includesFilename(resolved)) return join(baseOutDir, resolved);
-        return join(baseOutDir, resolved, defaultName);
+        if (includesFilename(resolved)) return assertWithinBase(baseOutDir, join(baseOutDir, resolved));
+        return assertWithinBase(baseOutDir, join(baseOutDir, resolved, defaultName));
     }
     if (output) {
-        if (includesFilename(output)) return join(baseOutDir, output);
-        return join(baseOutDir, output, relDir, defaultName);
+        if (includesFilename(output)) return assertWithinBase(baseOutDir, join(baseOutDir, output));
+        return assertWithinBase(baseOutDir, join(baseOutDir, output, relDir, defaultName));
     }
-    return join(baseOutDir, relDir, defaultName);
+    return assertWithinBase(baseOutDir, join(baseOutDir, relDir, defaultName));
 }
 
 export function computeContractOutPath(
@@ -86,14 +103,14 @@ export function computeSdkOutPath(
 
     if (clientOutput && TEMPLATE_VAR_RE.test(clientOutput)) {
         const resolved = resolveTemplate(clientOutput, { filename, dir: relDir, ext: 'ck', ...meta });
-        if (includesFilename(resolved)) return join(baseOutDir, resolved);
-        return join(baseOutDir, resolved, defaultOutName);
+        if (includesFilename(resolved)) return assertWithinBase(baseOutDir, join(baseOutDir, resolved));
+        return assertWithinBase(baseOutDir, join(baseOutDir, resolved, defaultOutName));
     }
     if (clientOutput) {
-        if (includesFilename(clientOutput)) return join(baseOutDir, clientOutput);
-        return join(baseOutDir, clientOutput, relDir, defaultOutName);
+        if (includesFilename(clientOutput)) return assertWithinBase(baseOutDir, join(baseOutDir, clientOutput));
+        return assertWithinBase(baseOutDir, join(baseOutDir, clientOutput, relDir, defaultOutName));
     }
-    return join(baseOutDir, relDir, defaultOutName);
+    return assertWithinBase(baseOutDir, join(baseOutDir, relDir, defaultOutName));
 }
 
 /**
@@ -118,14 +135,14 @@ export function computeSdkAreaClientOutPath(area: string, rootDir: string, clien
     if (clientOutput && TEMPLATE_VAR_RE.test(clientOutput)) {
         const resolved = resolveTemplate(clientOutput, { filename, dir: '', ext: 'ck', area, subarea: '' });
         const cleaned = fixHiddenSegment(resolved.replace(/\/+/g, '/').replace(/^\//, ''));
-        if (includesFilename(cleaned)) return join(baseOutDir, cleaned);
-        return join(baseOutDir, cleaned, `${filename}.client.ts`);
+        if (includesFilename(cleaned)) return assertWithinBase(baseOutDir, join(baseOutDir, cleaned));
+        return assertWithinBase(baseOutDir, join(baseOutDir, cleaned, `${filename}.client.ts`));
     }
     if (clientOutput) {
-        if (includesFilename(clientOutput)) return join(baseOutDir, clientOutput);
-        return join(baseOutDir, clientOutput, `${filename}.client.ts`);
+        if (includesFilename(clientOutput)) return assertWithinBase(baseOutDir, join(baseOutDir, clientOutput));
+        return assertWithinBase(baseOutDir, join(baseOutDir, clientOutput, `${filename}.client.ts`));
     }
-    return join(baseOutDir, `${filename}.client.ts`);
+    return assertWithinBase(baseOutDir, join(baseOutDir, `${filename}.client.ts`));
 }
 
 export function computeSdkTypeOutPath(
@@ -144,11 +161,11 @@ export function computeSdkTypeOutPath(
 
     if (TEMPLATE_VAR_RE.test(typeOutput)) {
         const resolved = resolveTemplate(typeOutput, { filename, dir: relDir, ext: 'ck', ...meta });
-        if (includesFilename(resolved)) return join(baseOutDir, resolved);
-        return join(baseOutDir, resolved, defaultOutName);
+        if (includesFilename(resolved)) return assertWithinBase(baseOutDir, join(baseOutDir, resolved));
+        return assertWithinBase(baseOutDir, join(baseOutDir, resolved, defaultOutName));
     }
-    if (includesFilename(typeOutput)) return join(baseOutDir, typeOutput);
-    return join(baseOutDir, typeOutput, relDir, defaultOutName);
+    if (includesFilename(typeOutput)) return assertWithinBase(baseOutDir, join(baseOutDir, typeOutput));
+    return assertWithinBase(baseOutDir, join(baseOutDir, typeOutput, relDir, defaultOutName));
 }
 
 export function generateBarrelFiles(contractPaths: string[]): { outPath: string; content: string }[] {

package/src/ts-render.ts

@@ -1,4 +1,4 @@
-import type { ContractTypeNode, FieldNode } from '@contractkit/core';
+import type { ContractTypeNode, FieldNode, ScalarTypeNode } from '@contractkit/core';
 
 export const JSON_VALUE_TYPE_DECL = 'export type JsonValue = string | number | boolean | null | JsonValue[] | { [key: string]: JsonValue };';
 
@@ -6,6 +6,18 @@ export function quoteKey(name: string): string {
     return /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(name) ? name : `'${name}'`;
 }
 
+/** Escape text for safe inclusion inside a JSDoc block comment: neutralize the
+ *  block-comment terminator sequence and split embedded newlines into separate
+ *  ` * ` continuation lines. Returns the content lines (WITHOUT a leading prefix). */
+export function escapeJsDocLines(text: string): string[] {
+    return text.replace(/\*\//g, '*\\/').split('\n');
+}
+
+/** Escape a string for inclusion inside a single-quoted TypeScript string literal. */
+export function escapeSingleQuoted(s: string): string {
+    return s.replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/\n/g, '\\n').replace(/\r/g, '\\r');
+}
+
 /** Convert an HTTP header name (e.g. `preference-applied`, `X-Request-ID`, `ETag`) to camelCase for use as a JS property. */
 export function headerNameToProperty(name: string): string {
     const parts = name.split(/[-_]/).filter(Boolean);
@@ -37,9 +49,9 @@ export function renderTsType(type: ContractTypeNode): string {
         case 'record':
             return `Record<${renderTsType(type.key)}, ${renderTsType(type.value)}>`;
         case 'enum':
-            return type.values.map(v => `'${v}'`).join(' | ');
+            return type.values.map(v => `'${escapeSingleQuoted(v)}'`).join(' | ');
         case 'literal':
-            return typeof type.value === 'string' ? `'${type.value}'` : String(type.value);
+            return typeof type.value === 'string' ? `'${escapeSingleQuoted(type.value)}'` : String(type.value);
         case 'union':
             return type.members.map(renderTsType).join(' | ');
         case 'discriminatedUnion':
@@ -57,7 +69,7 @@ export function renderTsType(type: ContractTypeNode): string {
     }
 }
 
-function renderTsScalar(name: string): string {
+function renderTsScalar(name: ScalarTypeNode['name']): string {
     switch (name) {
         case 'string':
         case 'email':
@@ -72,6 +84,7 @@ function renderTsScalar(name: string): string {
         case 'boolean':
             return 'boolean';
         case 'date':
+        case 'time':
         case 'datetime':
         case 'duration':
         case 'interval':
@@ -86,8 +99,10 @@ function renderTsScalar(name: string): string {
             return 'Blob';
         case 'json':
             return 'JsonValue';
-        default:
-            return 'unknown';
+        default: {
+            const _exhaustive: never = name;
+            throw new Error(`plugin-typescript: unmapped scalar '${String(_exhaustive)}' — add a case`);
+        }
     }
 }
 

package/tests/codegen-contract.test.ts

@@ -26,6 +26,10 @@ describe('renderType', () => {
             expect(renderType(scalarType('string'))).toBe('z.string()');
         });
 
+        it('throws on an unmapped scalar name', () => {
+            expect(() => renderType({ kind: 'scalar', name: 'decimal' } as any)).toThrow(/unmapped scalar 'decimal'/);
+        });
+
         it('renders z.string() with min/max', () => {
             expect(renderType(scalarType('string', { min: 1, max: 100 }))).toBe('z.string().min(1).max(100)');
         });

package/tests/codegen-sdk.test.ts

@@ -1110,6 +1110,14 @@ describe('renderTsType', () => {
         it('maps json to JsonValue', () => {
             expect(renderTsType(scalarType('json'))).toBe('JsonValue');
         });
+
+        it('maps time to string', () => {
+            expect(renderTsType(scalarType('time'))).toBe('string');
+        });
+
+        it('throws on an unmapped scalar name', () => {
+            expect(() => renderTsType({ kind: 'scalar', name: 'decimal' } as any)).toThrow(/unmapped scalar 'decimal'/);
+        });
     });
 
     it('renders tuple type', () => {

package/tests/escaping-security.test.ts

@@ -0,0 +1,143 @@
+import { generateContract, renderType } from '../src/codegen-contract.js';
+import { generatePlainTypes } from '../src/codegen-plain-types.js';
+import { generateOp } from '../src/codegen-operation.js';
+import { renderTsType, escapeJsDocLines, escapeSingleQuoted } from '../src/ts-render.js';
+import { computeOpOutPath, computeSdkOutPath, computeSdkTypeOutPath, computeSdkAreaClientOutPath } from '../src/path-utils.js';
+import { field, model, contractRoot, enumType, scalarType, opRoot, opRoute, opOperation, opResponse } from './helpers.js';
+
+// ─── Fix 1: JSDoc comment injection via descriptions ────────────────────────
+
+describe('JSDoc comment injection (descriptions)', () => {
+    it('neutralizes `*/` in a model description (Zod codegen)', () => {
+        const root = contractRoot([model('Widget', [field('id', scalarType('uuid'))], { description: 'closes */ early' })]);
+        const out = generateContract(root);
+        // The raw terminator must not appear inside the generated comment.
+        expect(out).not.toContain('closes */ early');
+        expect(out).toContain('closes *\\/ early');
+    });
+
+    it('splits a two-line model description into ` * ` continuation lines (Zod codegen)', () => {
+        const root = contractRoot([model('Widget', [field('id', scalarType('uuid'))], { description: 'line one\nline two' })]);
+        const out = generateContract(root);
+        expect(out).toContain(' * line one');
+        expect(out).toContain(' * line two');
+    });
+
+    it('neutralizes `*/` in a model description (plain-types codegen)', () => {
+        const root = contractRoot([model('Widget', [field('id', scalarType('uuid'))], { description: 'closes */ early' })]);
+        const out = generatePlainTypes(root);
+        expect(out).not.toContain('closes */ early');
+        expect(out).toContain('closes *\\/ early');
+    });
+
+    it('neutralizes `*/` in a field description (plain-types codegen)', () => {
+        const root = contractRoot([model('Widget', [field('id', scalarType('uuid'), { description: 'bad */ desc' })])]);
+        const out = generatePlainTypes(root);
+        expect(out).not.toContain('bad */ desc');
+        expect(out).toContain('bad *\\/ desc');
+    });
+
+    it('splits a two-line field description into a multi-line JSDoc block (plain-types codegen)', () => {
+        const root = contractRoot([model('Widget', [field('id', scalarType('uuid'), { description: 'first\nsecond' })])]);
+        const out = generatePlainTypes(root);
+        expect(out).toContain('first');
+        expect(out).toContain('* second');
+        // No premature close on the same physical line as content.
+        expect(out).not.toMatch(/first\nsecond/);
+    });
+
+    it('neutralizes `*/` in an operation description (server codegen)', () => {
+        const root = opRoot([opRoute('/x', [opOperation('get', { description: 'op */ desc', responses: [opResponse(200)] })])]);
+        const out = generateOp(root);
+        expect(out).not.toContain('op */ desc');
+        expect(out).toContain('op *\\/ desc');
+    });
+
+    it('escapeJsDocLines neutralizes terminators and splits newlines', () => {
+        expect(escapeJsDocLines('a */ b')).toEqual(['a *\\/ b']);
+        expect(escapeJsDocLines('a\nb')).toEqual(['a', 'b']);
+    });
+});
+
+// ─── Fix 2: enum / literal value escaping ───────────────────────────────────
+
+describe('enum value escaping', () => {
+    it('escapes double and single quotes in a Zod enum', () => {
+        const out = renderType(enumType('a"b', "c'd"));
+        expect(out).toBe('z.enum(["a\\"b", "c\'d"])');
+    });
+
+    it('escapes single quotes in a TS union of enum values', () => {
+        const out = renderTsType(enumType('a"b', "c'd"));
+        expect(out).toBe("'a\"b' | 'c\\'d'");
+    });
+
+    it('escapes single quotes in a TS string literal', () => {
+        expect(renderTsType({ kind: 'literal', value: "it's" })).toBe("'it\\'s'");
+    });
+
+    it('escapeSingleQuoted escapes backslashes, quotes and newlines', () => {
+        expect(escapeSingleQuoted("a'b\\c\nd")).toBe("a\\'b\\\\c\\nd");
+    });
+});
+
+// ─── Fix 3: signature interpolation escaping ────────────────────────────────
+
+describe('signature escaping (server codegen)', () => {
+    it('escapes a single quote in the signature value', () => {
+        const root = opRoot([opRoute('/x', [opOperation('get', { signature: "sig'v", responses: [opResponse(200)] })])]);
+        const out = generateOp(root);
+        expect(out).toContain("requireSignature('sig\\'v')");
+    });
+
+    it('escapes single quotes in signature and policy', () => {
+        const root = opRoot([
+            opRoute('/x', [opOperation('get', { signature: "sig'v", signaturePolicy: "pol'y", responses: [opResponse(200)] })]),
+        ]);
+        const out = generateOp(root);
+        expect(out).toContain("requireSignature('sig\\'v', { policy: 'pol\\'y' })");
+    });
+});
+
+// ─── Fix 4: path traversal via .ck-derived template vars ────────────────────
+
+describe('path traversal containment', () => {
+    const base = '/project/out';
+
+    it('throws when a `.ck`-derived {area} escapes the base output dir', () => {
+        expect(() =>
+            computeOpOutPath('/project/contracts/a.ck', base, '{area}/{filename}.ts', '.ts', '/project/contracts', {
+                area: '../../../tmp/x',
+            }),
+        ).toThrow(/Refusing to emit outside output directory/);
+    });
+
+    it('throws when a `.ck`-derived {filename} escapes the base output dir', () => {
+        expect(() =>
+            computeSdkTypeOutPath('/project/contracts/a.ck', base, '{filename}.ts', '/project/contracts', {
+                filename: '../../etc/passwd',
+            }),
+        ).toThrow(/Refusing to emit outside output directory/);
+    });
+
+    it('throws for computeSdkOutPath traversal', () => {
+        expect(() =>
+            computeSdkOutPath('/project/contracts/a.ck', base, '{area}/{filename}.ts', '/project/contracts', {
+                area: '../../../evil',
+            }),
+        ).toThrow(/Refusing to emit outside output directory/);
+    });
+
+    it('throws for computeSdkAreaClientOutPath traversal', () => {
+        expect(() => computeSdkAreaClientOutPath('../../../evil', base, '{area}/{filename}.client.ts')).toThrow(
+            /Refusing to emit outside output directory/,
+        );
+    });
+
+    it('allows a normal in-base path', () => {
+        const p = computeOpOutPath('/project/contracts/a.ck', base, '{area}/{filename}.ts', '.ts', '/project/contracts', {
+            area: 'billing',
+        });
+        expect(p).toBe('/project/out/billing/a.ts');
+    });
+});